[SM-Security] [Bug 7530] [sorcery/installwatch] insecure tmp file handling vulnerability
bugzilla-daemon at metalab.unc.edu
bugzilla-daemon at metalab.unc.edu
Tue Oct 19 00:28:29 EDT 2004
http://bugs.sourcemage.org/show_bug.cgi?id=7530
acedit at armory.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
------- Additional Comments From acedit at armory.com 2004-10-19 00:28 -------
This should be fixed with change 45229, the file now lives in a
unique /tmp/sorcery sub-directory directory which is owned by root.
/tmp/sorcery is guarenteed to be owned by root with perms 755, if it
isnt sorcery makes sure it is. The actual $TMP_DIR is guarenteed to be
created by cast with perms 755 and owned by root, if it already exists its
removed and re-created. In other words there shouldnt be any way for an
attacker to place clever symlinks in $TMP_DIR without being root.
Thanks for pointing out this class of exploits. Had I known earlier I would
have spent more time moving files to safer locations rather than taking
the "if its not broken dont fix it" approach.
Let me know if there are any weaknesses in libmisc::mk_tmp_dirs, and
if possible ways to fix it.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
More information about the SM-Security
mailing list